This can be done in the span of about 5 minutes(it’s almost tooooo easy).<\/p>\n
First, ensure that you have public access to TCP ports 80\/443 to your tower server(it’s likely you’ve already done that, though).<\/p>\n
Tower auto installs and uses nginx as its webserver. Step one is to tell nginx what your FQDN is for this server(make sure you’ve already created a valid\/working DNS entry for this):
\nEdit the nginx config file at: \/etc\/nginx\/nginx.conf
\nThis is the section of the config prior to manipulation:<\/p>\n
# If you have a domain name, this is where to add it\r\nserver_name _;\r\nkeepalive_timeout 65;\r\n \r\nssl_certificate \/etc\/tower\/tower.cert;\r\nssl_certificate_key \/etc\/tower\/tower.key;<\/code><\/pre>\nThis is my config with the server name configured:<\/p>\n
# If you have a domain name, this is where to add it\r\nserver_name towerofpower.gregsowell.com;\r\nkeepalive_timeout 65;\r\n \r\nssl_certificate \/etc\/tower\/tower.cert;\r\nssl_certificate_key \/etc\/tower\/tower.key;<\/code><\/pre>\nNow restart the nginx server:<\/p>\n
systemctl reload nginx.service<\/code><\/pre>\nNow download the LetsEncrypt certbot auto installer and set it to executable:<\/p>\n
wget -P \/usr\/local\/bin https:\/\/dl.eff.org\/certbot-auto\r\nchmod +x \/usr\/local\/bin\/certbot-auto<\/code><\/pre>\nNow run the certbot installer:<\/p>\n
certbot-auto\r\n\r\nBootstrapping dependencies for RedHat-based OSes that will use Python3... (you can skip this with --no-bootstrap)\r\ndnf is \/usr\/bin\/dnf\r\ndnf is hashed (\/usr\/bin\/dnf)\r\nLast metadata expiration check: 2:31:18 ago on Thu 18 Jun 2020 08:35:47 AM CDT.\r\nPackage openssl-1:1.1.1c-15.el8.x86_64 is already installed.\r\nPackage ca-certificates-2019.2.32-80.0.el8_1.noarch is already installed.\r\nPackage python36-3.6.8-2.module_el8.1.0+245+c39af44f.x86_64 is already installed.\r\nDependencies resolved.\r\n=================================================================================================================================================\r\n Package Architecture Version Repository Size\r\n=================================================================================================================================================\r\nInstalling:\r\n augeas-libs x86_64 1.12.0-5.el8 BaseOS 436 k\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nTransaction Summary\r\n=================================================================================================================================================\r\nInstall 44 Packages\r\n\r\nTotal download size: 52 M\r\nInstalled size: 135 M\r\nIs this ok [y\/N]: y\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nWhich names would you like to activate HTTPS for?\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n1: towerofpower.gregsowell.com\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nSelect the appropriate numbers separated by commas and\/or spaces, or leave input\r\nblank to select all options shown (Enter 'c' to cancel): 1\r\nObtaining a new certificate\r\nPerforming the following challenges:\r\nhttp-01 challenge for towerofpower.gregsowell.com\r\nWaiting for verification...\r\nCleaning up challenges\r\nDeploying Certificate to VirtualHost \/etc\/nginx\/nginx.conf\r\nRedirecting all traffic on port 80 to ssl in \/etc\/nginx\/nginx.conf<\/code><\/pre>\nSo when you run the installer you are prompted to pull down required packages, to which I said yes. It will then find your nginx config and locate the server name that was specified. After that I chose option 1 and let it rip.
\nIt then creates the certs and modifies the nginx config with the new certs.<\/p>\n
Here’s the nginx config after the above command:<\/p>\n
# If you have a domain name, this is where to add it\r\n server_name towerofpower.gregsowell.com;\r\n keepalive_timeout 65;\r\n ssl_certificate \/etc\/letsencrypt\/live\/towerofpower.gregsowell.com\/fullchain.pem; # managed by Certbot\r\n ssl_certificate_key \/etc\/letsencrypt\/live\/towerofpower.gregsowell.com\/privkey.pem; # managed by Certbot<\/code><\/pre>\nNow restart the nginx server:<\/p>\n
systemctl reload nginx.service<\/code><\/pre>\nAfter that you should be able to browse to your tower install with a valid cert! <\/p>\n
Good luck and happy automating.<\/p>\n","protected":false},"excerpt":{"rendered":"
This can be done in the span of about 5 minutes(it’s almost tooooo easy). First, ensure that you have public access to TCP ports\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49,13],"tags":[],"class_list":["post-6320","post","type-post","status-publish","format-standard","hentry","category-ansible","category-server"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/6320","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6320"}],"version-history":[{"count":4,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/6320\/revisions"}],"predecessor-version":[{"id":6324,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/6320\/revisions\/6324"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6320"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6320"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6320"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}